Network address translation (NAT) devices translate the addresses and ports for network packets destined to or originating from internal hosts and servers within a local area network (LAN).
NAT provides at least two significant benefits for a LAN's operation. First, NAT can hide the true address of an internal host from the outside world. This is very important for the purpose of protecting the internal host from security attacks. For example, if an attacker does not know the true address of a device on a LAN, because packets from the device are mapped by a NAT device so as to hide the device's true address, it is difficult for the attacker to launch an effective attack against that device.
Second, NAT allows a LAN to use many more private addresses for internal use than the number of public addresses it owns. This feature has significantly relieved the problem of limited address capacity offered by 32 bit addresses. For instance, multiple LANs can share the same group of private network addresses for their internal use as long as they have unique public addresses. As a result, private addresses are used within a LAN between internal hosts and public addresses are used for communication across the Internet.
However, the usage of NAT provides a challenge for early detection of network security attacks. Current security devices such as firewalls, virtual private network (VPN) gateways, intrusion detection systems (IDS) generate events/alarms upon detecting a security attack. An event message typically contains the network addresses of the suspected intruder and the attacked host as well as the target TCP/IP application, e.g. HTTP or FTP, on the attacked host. Correlation of a stream of events from different security devices, all relating to messages between the same suspected intruder and the same host helps to detect an attack as early as possible.
As shown in FIG. 1, in order to quickly detect a security attack against a computer network, multiple security devices are deployed over the Internet. Each security device is configured such that whenever it detects a suspicious event, e.g., an IP packet, it sends an event message to a network security monitor. The network security monitor is responsible for correlating diverse events from different parts of the network and providing insights into higher-level attack scenarios.
Because of NAT, events from different devices may have different addresses for a single suspected intruder or a single attacked host, which makes it difficult to correlate these events. As a result, a direct analysis of a stream of events from different security devices may not appropriately reveal the existence of a security attack.
Therefore, it would be desirable to develop a method and system that can recognize that a stream of network events from different security devices were all generated in response to a message from a source to a destination, even though these events may have different source and destination information due to NAT operations performed on the message as it moves through the network.